White Paper
EU Excipient Risk Assessment
Guidelines – Practical Implementation
Experience
Frithjof Holtz, Advocacy & Surveillance, Life Science Regulatory
Management, Merck KGaA, Darmstadt, Germany
The Challenges of Determining The EU Excipient Risk Assessment
Excipient Quality Guidelines
In the past years, the critical role of excipients in In 2011, the EU’s Falsified Medicines Directive
drug production has come into focus. This meant established that pharmaceutical manufacturers must
shaking off the long prevailing perception of excipients conduct a formalized risk assessment for each excipient
being passive additions to an active pharmaceutical they use and determine its appropriate GMP (1). It also
ingredient (API). Now regulatory authorities are calling stated that the European Commission would develop
for more stringent quality management in excipient guidelines offering direction on the risk management
production and use, leading to new requirements for process and the appropriate level of GMP for excipients.
both excipient suppliers and drug manufacturers.
Based on this directive, the EU Excipient Risk
Regulating excipient quality, however, is no small Assessment Guidelines were drafted in 2013, published
task. More than one thousand different excipients in March 2015 after intense discussion, and came into
are available, and only a small number of them are force one year later on March 21, 2016 (2). They were
manufactured solely for pharmaceutical use. This also referred to as binding guidelines in the revised EU
heterogeneity and the resulting complexity have led rules governing GMP for medicinal products (3), which
to the EU Commission’s approach to excipient quality. further underlines their importance.
It is clearly risk-based; its core consists of general
guidelines that offer a framework for excipient risk In terms of content, the EU Excipient Risk Assessment
assessment. However, the guidelines provide neither Guidelines address both the intended use and source of
detailed instructions for implementation nor a clear excipients. The main topics are described in chapter 2
definition of appropriate Good Manufacturing Practices to 4, which cover:
(GMP) for excipients. This is the responsibility of the
manufacturing authorization holder – and evidently no
small task either. • Determining appropriate GMP based on excipient
type and use (chapter 2)
Readers of this white paper will find support in
mastering the challenge of formalized excipient risk • Determining the excipient manufacturer’s risk profile
assessment. They will gain an overview of the relevant (chapter 3)
laws and guidelines, as well as voluntary standards
developed by the industry to foster implementation. • Confirming the implementation of appropriate GMP
Most importantly, a case study on excipient risk (chapter 4).
assessment will provide valuable insights into risk
assessment and preparing for inspections.
The life science business of Merck KGaA,
Darmstadt, Germany operates as
MilliporeSigma in the U.S. and Canada.
Relevance beyond the EU process and defining appropriate GMP for all excipients
is clearly the responsibility of medicinal product
The EU Excipient Risk Assessment Guidelines represent manufacturers. However, they do not have to develop
the first regulation dedicated to excipient GMP in their own criteria. In fact, they can follow several well-
the EU. They apply not only to medicinal products established, voluntary industry standards. Based on
manufactured in Europe but also to those produced the Manufacturing Authorization Holders classification
elsewhere if they are intended for the European of excipients into low, medium or high-risk categories
market. The important role of the EU guidelines is as recommended by the EU guidelines, these voluntary
also acknowledged beyond the EU, as for example by industry standards help to define the appropriate GMP.
the Pharmaceutical Inspection Co-operation Scheme These standards are not binding regulations, but are
(PIC/S), which adopted the guidelines on a voluntary based on best industry practices, offering guidance and
basis in July 2018 (4). facilitating implementation.
Around the globe, other regions have also developed The IPEC PQG GMP Guide 2017 (6) is an important
specific approaches to enhancing the safety and example. IPEC (International Pharmaceutical Excipient
quality of pharmaceutical products, extending the Council), the international organization representing
requirements beyond APIs. The U.S. Food and Drug excipient producers and users, provides excipient
Administration (FDA) states that the current term GMP manufacturers with a voluntary standard on GMP for
includes “establishing the safety of raw materials, pharmaceutical excipients.
materials used in the manufacture of drugs and
finished products” (5). Combined with the How-To document (7) published
by IPEC Europe in 2016, this gives pharmaceutical
manufacturers a good initial guidance. The step-by-
step document helps them to perform risk assessments
Helpful Industry Standards to define appropriate GMP for excipients. It also offers
a clearly arranged process overview of how to comply
It is important to understand that the EU Excipient with the requirements outlined in the EU Excipient Risk
Risk Assessment Guidelines only provide a general Assessment Guidelines (see Table 1).
framework. Developing a compliant risk assessment
Table 1:
Risk assessment process to ensure appropriate GMP implementation, according to IPEC Europe’s “How-To” document
2
In summary, the following list of voluntary standards Risks from the excipient manufacturer or supplier
should be appropriate in most cases: perspective (SOURCE criteria):
• Quality Management System applied by the excipient
• IPEC-PQG GMP Guide 2017 (see above) supplier
• USP General Chapter 1078: The standard issued • Contamination potential
by the United States Pharmacopeia (USP) includes
in-depth descriptions of GMP for bulk pharmaceutical • Impurities in general (regarding the excipient and the
excipients (8). manufacturing process)
• EXCiPACT™: The standard on GMP and GDP • TSE, viral safety
for excipients and the auditing scheme assists
pharmaceutical companies ensure their regulatory • Microbiological/endotoxin contamination
compliance and strengthen safety and quality
throughout the excipient supply chain (9). • Dedicated equipment/facilities (versus multi-purpose
facilities involving higher risk)
• NSF/IPEC/ANSI-363-2016: This document is the
first American national standard for pharmaceutical • Environmental control and storage conditions
excipients, published by the global public health
organization NSF International. It is based on the • Supply chain complexity
requirements of the EXCiPACT™ standard (10).
Risks regarding the application of excipients
(USE criteria):
Learning from real Experience
• Dosage form
Still, implementation remains a huge challenge for
manufacturers and users of excipients. Given the • Route of administration (e.g. tablets, parenteral use
abundance of excipients, formalized risk assessment involving higher risk)
might even seem infeasible. Also, the sheer number of
supporting documents can be overwhelming, regardless • Functionality (e.g. colorant, filler, part of release
of how helpful they are. system involving higher risk)
The following real-life case study was conducted to • Potential impact on critical quality attributes of the
simplify the task and to enable effective learning drug product
through practical experience. The lessons learned
by and with manufacturers will help to facilitate the • Quantity, daily intake
efficient implementation of a risk assessment process
that is both compliant and sustainable.
By applying these criteria, five distinct quality areas
The starting point was to answer the key question were defined, and need to be considered:
“what do medicinal product manufacturers need to the Quality Management System (QMS), manufacturing
consider?” Two lists of criteria capture risks related to of excipients, supply chain, route of administration
excipients based on the EU Guideline: on the one hand and function of the excipient. Based on these initial
from a manufacturing or supply perspective and, on considerations, the case study was conducted in four
the other hand, from an application point of view. steps. Prior to the actual assessment process, the
medicinal products produced under the responsibility
of the pharmaceutical manufacturer were examined in
order to identify all excipients to be assessed, as well
as their respective use. This yielded 24 excipients to be
investigated and assessed step-by-step:
3
Step 1 comprised the supplier qualification. Here, Step 3 involved determining the supplier risk, based
the EU guidelines were translated into a checklist, on the previous definition of minimum requirements
i.e., a supplier questionnaire. The responses were derived from documents such as the IPEC-PQG GMP
harmonized and collated in an Excel spreadsheet. Guide and EXCiPACT™.
In step 2, an excipient risk ranking template covering Based on a gap analysis, a risk profile for each supplier
all elements of the EU guidelines was developed. It was created in step 4, with the goal of also finding
provides a three-part risk score (low, medium and effective mitigation options, such as an update of the
high) for each excipient, which reflects both the Quality Assurance Agreement (QAA) or intensified
individual criteria and the resulting overall risk score incoming goods control.
(see Table 2). As guidance for risk prioritization, ICH
Q9 Quality Risk Management (12) was used.
Risk Assessment Result
Known of
Any known potential impact Function of Proportion of Daily patient
quality defects/ on the critical excipient in the excipient in intake of the
fraudulent adul- quality attributes the formula- the medicinal excipient for
terations related of the medicinal tion product compo- information
to the excipient product sition only
Excipient name Sum of Amount Risk
points of high Profile
risks
1=no 1=no 1=Processa- 1=<5% for informa-
2=yes, non- 3=yes bility 2=5-25% tion only
critical 3=Bioavaila- 3=>25%
3=yes, bility
critical
Benzylalcohol 1 3 1 3 no 26 4 medium
Citric acid anhydrous 1 3 3 1 yes 28 5 medium
Citric acide
1 3 1 1 no 22 2 medium
monohydrate
Creatinine 1 3 1 1 yes 20 1 medium
Disodium edetate 1 3 1 1 yes 24 3 medium
Ethanol 1 3 1 1 yes 24 3 medium
Glycerol 1 3 1 3 yes 25 3 medium
Glycine 1 3 1 1 no 22 2 medium
Hydrochloric acid 1 3 1 1 yes 26 4 medium
Table 2:
The assessment includes the ranking of single risks and the resulting overall risk profile by taking the sum of risk points and the amount of high risks
into consideration (extract of the risk assessment).
4
The Overall Outcome Is Key It is also important to note that the risk assessment is
no substitute for regular audits, since the information
The excipient risk ranking through steps 1 and 2 provided by suppliers and manufacturers does not
resulted in all 24 excipients being classified as medium necessarily reflect the degree of compliance in day-to-
risk. It is important to note that this classification day business.
represents an overall ranking, as explicitly required by
the guidelines. This means that excipients can have By far the greatest challenge, however, was to translate
high single risks – which need to be closely looked into the relevant points from the EU guidelines into a
– but can still be classified as medium risk overall, as supplier questionnaire – and to find an appropriate
was the case here. procedure for risk prioritization on the basis of the
responses. Some of the questions in this process were:
In summary, the high single risks identified showed “What are significant single risks?”, “What is the best
that storage monitoring and packaging are important way of weighting risks?” and “Which risks generate
considerations regarding the excipient’s source, points to be added, which risks should be considered
whereas the dosage form (e.g. parenteral), permanent as multipliers?”. Here, the ICH Q9 Quality Risk
intake and function (e.g. excipient as part of the Management offered a valuable resource, as foreseen
delivery system) are particularly relevant regarding the by the EU guidelines. This document attaches particular
excipients’ use. importance to using scientific knowledge and balancing
the level of formality of the risk management process
The gap analysis at the supplier end (step 4) resulted with the level of risk posed by the excipient. This gives
in 14 excipients being classified as low risk, and 10 as manufacturers and suppliers a certain degree of leeway
medium risk. This classification was based on minimum in terms of defining a specific prioritization system.
requirements derived from the IPEC-PQG GMP
Guide and EXCiPACT™ (step 3). The gaps identified
included a potential for microbiological or endotoxin/
pyrogen contamination – with the mitigation option of Tried and Tested Tools
performing additional Quality Control (QC) testing in
the manufacturing authorization holder’s laboratory. The case study also showed how important open
Other gaps identified concerned environmental control and structured communication between the drug
and control of storage/transportation conditions manufacturer and excipient supplier is. In addition,
including cold chain management and packaging suppliers can actively contribute to a good risk
integrity. assessment process by following established guidelines,
fulfilling information needs and providing timely
In summary, none of the 24 excipients assessed was documentation, ideally bundled in packages and
classified as high-risk. 20 excipients showed high single transmitted electronically.
risks. 14 excipients fulfilled all GMP requirements,
meaning that no gap was identified at the supplier/ The Emprove® Program was introduced in order to
manufacturer end. simplify this process and to help drug manufacturers
overcome the challenges of supplying “inspection-
friendly” documentation. It provides tried and tested
tools, including comprehensive documentation
Lessons Learned packages. Regarding excipient risk assessment, the
tools and information help to efficiently implement
One of the key lessons learned from the case study a compliant and sustainable risk assessment
was that, in many cases, obtaining meaningful data process, which optimally prepares pharmaceutical
posed a tremendous challenge. For example, suppliers manufacturers for inspections.
did not provide data in a timely manner, the data
was incomplete, contradictory or not delivered in the
requested, or even in a uniform, format. Also, the
sheer amount of data was overwhelming, making data Learn more about
transfer and dealing with huge spreadsheets both the Emprove® Program here:
error-prone and time-consuming. All this shows that [Link]/emprove
it takes significant resources to manage this task.
Moreover, cross-functional teams are important to
bring in all relevant competencies. In other words, a
strong commitment and awareness on the part of the
management are called for.
Another major challenge consisted in providing a
sustainable risk assessment process, i.e. transferring it
to daily business and keeping it up to date. The process
should ideally be integrated into the QMS, considering
both regular review and ad-hoc changes.
5
References
1. European Commission (2011): Directive 2011/62/EU, article 46f., 8. United States Pharmacopoeia: General Chapter 1078, [Link]
[Link] [Link]/usp31/v31261/usp31nf26s1_c1078.asp, accessed July
[Link]N:PDF accessed on July 8, 2019. 8,2019.
2. European Commission (2015): Guidelines of 19 March 2015 on the 9. EXCiPACT™ (2017): Certification Standards for Pharmaceutical
formalised risk assessment for ascertaining the appropriate good Excipient Suppliers: Good Manufacturing Practices, Good
manufacturing practice for excipients of medicinal products for Distribution Practices – Requirements for Auditor Competency
human use (2015/C 95/02), [Link] and Third Party Audit Organisations Providing Certification of the
EN/TXT/PDF/?uri=CELEX:52015XC0321(02)&from=RO, accessed on Management System, [Link]
July 8,2019. Downloads/20180123%20EXC%20Standard_Final-[Link],
accessed July 8, 2019.
3. European Commission (2014): The Rules Governing Medicinal
Products in the European Union, Volume 4, Part 1, Chapter 5, • NSF International (2015): NSF/IPEC/ANSI 363: Good Manufacturing
10.
[Link] Practices (GMP) for Pharmaceutical Excipients, [Link]
chapter_5.pdf, accessed on July 8, 2019. newsroom/national-standard-for-excipient-good-manufacturing-
practices-published-by-n, accessed July 8, 2019.
4. PIC/S (2018): Guidelines on the Formalised Risk Assessment for
Ascertaining the Appropriate Good Manufacturing Practice for 11.
• Stanton, Dan (2018): IPEC and PDA team on excipient risk
Excipients of Medicinal Products for Human Use, [Link] assessment guidance, [Link]
[Link]/layout/[Link]?id=1414, accessed July com/Article/2018/03/22/IPEC-and-PDA-team-on-excipient-risk-
8,2019. assessment-guidance, in-Pharma Technologist, accessed July 8,
2019.
5. FDA (2012): Safety and Innovation Act, Sec. 711. Enhancing
the safety and quality of the drug supply, [Link] • ICH (2005): Harmonised Tripartite Guideline Quality Risk
12.
regulatory-information/food-and-drug-administration-safety-and- Management Q9, [Link]
innovation-act-fdasia/fdasia-title-vii-overview#711, accessed July 8, ICH_Products/Guidelines/Quality/Q9/Step4/Q9_Guideline.pdf,
2019. accessed July 8, 2019.
6. IPEC Europe (2017): The Joint IPEC-PQG Good Manufacturing
Practices Guide, [Link]
(download function), accessed July 8, 2019.
7. IPEC Europe (2016): ‘How-To’ Document, Guidelines of 19 March
2015 on the formalised risk assessment for ascertaining the
appropriate good manufacturing practice for excipients of medicinal
products for human use (OJ 2015/C 95/02), [Link]
[Link]/guidemgr/files/160318_IE_HOW-TO_DO_
RAGUIDELINES_V1_2.PDF, accessed July 8,2019.
We provide information and advice to our customers on application technologies and regulatory matters to the best of our knowledge and ability,
but without obligation or liability. Existing laws and regulations are to be observed in all cases by our customers. This also applies in respect to
any rights of third parties. Our information and advice do not relieve our customers of their own responsibility for checking the suitability of our
products for the envisaged purpose.
For additional information, please visit [Link]
Merck, the Vibrant M, Emprove, Mobius, Millipore Express, SAFC and Pureflexare trademarks of Merck KGaA,
Darmstadt, Germany or its affiliates. All other trademarks are the property of their respective owners.
Detailed information on trademarks is available via publicly accessible resources.
© 2019 Merck KGaA, Darmstadt, Germany and/or its affiliates.
All Rights Reserved.
MK_WP4756EN
